Bug 2008291 (CVE-2021-41617)

Summary:	CVE-2021-41617 openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, caswilli, crypto-team, dbelyavs, dcommiss, dwalsh, fjansen, jburrell, jjelen, jnakfour, jwong, kaycoth, lkundrak, mattias.ellert, mcascell, psegedy, tm, vkumar, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssh 8.8	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privileges, potentially leading to local privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-23 18:09:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2011169, 2008292, 2008884, 2008885, 2008886, 2011167, 2011168
Bug Blocks:	2008294

Description Guilherme de Almeida Suckevicz 2021-09-27 20:00:37 UTC

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default
configurations are used, allows privilege escalation because supplemental groups
are not initialized as expected. Helper programs for AuthorizedKeysCommand and
AuthorizedPrincipalsCommand may run with privileges associated with group
memberships of the sshd process, if the configuration specifies running the
command as a different user.

References:
https://www.openwall.com/lists/oss-security/2021/09/26/1
https://www.openssh.com/txt/release-8.8
https://www.openssh.com/security.html

Comment 1 Guilherme de Almeida Suckevicz 2021-09-27 20:00:55 UTC

Created openssh tracking bugs for this issue:

Affects: fedora-all [bug 2008292]

Comment 4 Mauro Matteo Cascella 2021-10-05 17:49:48 UTC

Upstream commits:
https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455
https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde

Comment 7 Mauro Matteo Cascella 2021-10-14 15:43:13 UTC

From sshd_config's man page [1] helper programs for AuthorizedKeysCommand/AuthorizedPrincipalsCommand must be owned by root and not writable by group or others. This flaw requires local system access for the unprivileged malicious user to be able to tamper with the process being run to potentially gain additional privileges on the system.

[1] https://man.openbsd.org/sshd_config#AuthorizedKeysCommand

Comment 10 errata-xmlrpc 2021-11-23 17:14:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:4782 https://access.redhat.com/errata/RHSA-2021:4782

Comment 11 Product Security DevOps Team 2021-11-23 18:08:58 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-41617

Comment 12 errata-xmlrpc 2022-05-10 14:54:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:2013 https://access.redhat.com/errata/RHSA-2022:2013